start	end	text
6280	11340	Welcome to the Aerospace Village at DEF CON Safe Mode. My name is Kaylin Tricon. I'm the Director
11340	16400	of Communications at the Aerospace Village and Vice President at RockSolutions, a public affairs
16400	21560	agency where I lead the firm's cybersecurity practice. I am thrilled to be moderating this
21560	26940	panel on Hacking Cybersecurity Aerospace Regulation. The aerospace industry is highly
26940	31780	regulated with a great deal of focus on cybersecurity. Aerospace regulators play a key
31780	37320	role in understanding risk and putting in place the legal frameworks in creating rules, regulations,
37320	41760	and best practice around good faith research. Today's panel will look at how the aerospace
41760	47160	industry is approaching cybersecurity regulation and its relationship to good faith hackers and
47160	51620	researchers. We will look at how other sectors have approached regulation and partnered with
51620	56040	this community to increase resilience and highlight vulnerability. Now I'd like to
56040	63460	introduce our esteemed panelists. Nikki, will you kick us off? Sure, so my name is Nikki Keeley.
63460	68450	I'm the Head of Cybersecurity at the oversight of the UK Civil Aviation Authority.
69180	75540	So I work for the UKCA and as the UK's aviation regulator, we're responsible for overseeing the
75540	81940	implementation of cyber requirements in regulation for regulated aviation organizations. So that could
81940	86520	vary from airlines, through to airports, through to air navigation service providers,
86520	91480	or even drone operators. And it's really important for us that we have a proportionate and effective
91480	97560	approach and that most importantly we enable aviation to manage their own cyber security risks
97560	102100	without compromising aviation safety, security, or resilience.
103760	110720	Thanks. Harley? Hi, I'm Harley Geiger and I'm Director of Public Policy at Rapid7.
114180	120600	With offices around the world. I'm in the DC area and I run Rapid7's public policy and government
120600	126520	engagement activities. I've worked in privacy and cyber security technology policy and law
127200	132260	for about 10 years and I'm excited to be here. Thanks for having me.
132400	139120	Thanks. And Saulo? Well, thanks Katelyn for the invitation. My name is Saulo da Silva.
139120	147780	I work for ICAO. ICAO is the United Nations Agency responsible for the regulatory framework
147780	154500	of aviation on a global basis. I'm particularly chief of the global interoperable systems section.
154500	160480	It's a weird name, but basically what we do is take care of regulations regarding
160480	165420	information management, operational and safety critical information management,
165420	172920	including the aspects related to cyber safety and resilience. Basically keep the system going
172920	180440	no matter the type of problem that may happen coming from our new actors. Thank you.
181640	187240	Thanks, Saulo. All right, let's get started. I think it only makes sense to start with where
187240	192900	the industry is right now when it comes to aerospace cyber security regulation. Nikki,
192900	197540	I know that the UK has made significant strides when it comes to building bridges between security
197540	203900	researchers and industry and how that helps drive regulation. I'd love if you could kick us off and
203900	210920	talk a little bit about that evolution and where the UK is today. Sure, thanks. I don't know about
210920	216540	significant strides. I think we are starting to build the bridge, which is positive. So
217160	221140	in terms of lessons learned, I'd say the first hurdle that we really had to overcome
221140	227520	was this misconception that all a regulator wants to do is fine people, which is absolutely not the
227520	232920	case. At the end of the day, we're all here for the same reason. We know that our industry and
232920	237620	good faith hackers ultimately want to make aviation safer and more resilient. So I think
237620	243480	it's about breaking down that misconception. I think the second hurdle is around how do you
243480	249100	actually report? What mechanisms do you give individuals and good faith hackers to actually
249100	254800	report things? And we're lucky in one sense. In Europe, there's a regulation which is focused on
254800	261300	what we call mandatory involuntary occurrence reporting. So that's all about making sure that
261300	267300	safety information is reported, that it's collected, protected, analyzed, so that appropriate safety
267300	272600	action can be taken. And where there's a cyber vulnerability or a cyber incident, and that would
272600	278380	impact on those safety critical environments, then we believe that it's really important that
278380	283820	that information should be reported and acted on. And for organizations who aren't in scope of
283820	288860	that regulation, I just mentioned, then we also have a whistleblowing option available in the UK
288860	294360	under the Public Interest Disclosure Act. So that's all available on our website. So I think
294360	299020	the starting to build that bridge was making sure that it was clear that we want people to
299020	304820	get into contact. It's not about taking punitive action. It's about starting that dialogue and
304820	309320	conversation, and then showing that there's a mechanism for them to be able to do that,
309320	316200	and making those options available for contact. So I think that's really important for us.
316460	320640	That's great, Nikki. Has there been any significant challenges in communicating that message
320640	324060	to the community? Do you think that's where the hurdle lies?
324540	329940	Yeah, I think it's, you know, all regulators are different. I can only talk about aviation,
330460	334280	but different regulators might have different approaches. And I think it has been about how
334280	340240	do you get that message out there? And I think that's been developing slowly through our
340240	345680	relationship with industry. We started to build a really positive relationship with our industry.
345960	351780	You know, we've tried to make it clear that we want them to engage with us and collaborate with
351780	357700	us. And that it's not the case of never having a cyber incident. We expect that organizations
357700	362760	will have cyber incidents, and will find vulnerabilities. And it's more about, you know,
362760	368900	following what we call just culture in the safety sense, and reporting those that they can be fixed.
370600	377500	Thanks. And just keeping with, you know, laying the landscape out, Saulo, from a global perspective,
377500	382500	how do you think states are dealing with the challenge of aerospace cybersecurity regulation?
382540	386080	You know, what are some of the greatest challenges you think the industry faces?
387740	394360	Thanks, Kayleigh. You mentioned actually two important words here, that regulations and
394680	402360	a challenge. And I would put a little bit of spice and add one more, that is interoperability.
402360	408620	That for us in the aviation industry, is actually a bigger problem than just cybersecurity
409360	413640	regulation. It's really, it's really, how can I say, it's a problem of
414440	421980	divergence. So when we talk about unity in aviation in ICAO for the future, we need to
421980	428880	consider the impact of this digital transformation that is happening, and that we are living right
428880	435500	now, this digital evolution. And it's something that comes because we have several economic
435500	443140	drivers that are basically encouraging this digital transformation of the business. So
443640	451740	this will happen if we want or not. And we have to be prepared for that. We have
451740	456920	to have this increased digital data and information exchange. We know that this is
456920	463140	necessary to guarantee not only safety, but also to improve the efficiency of the system.
463140	471720	And of course, we know that everybody's taking actions to secure their part of the system.
471720	478440	But as I mentioned before, it's a problem of divergence. So one example of a divergent
478440	485420	digital process, we can say that, for example, manufacturers who needed to upload software
485420	493200	critical parts onto their craft, they are doing everything they should do to secure, for example,
493900	504340	the supply chain and to guarantee that they have a certified identity and the integrity of the data
504340	512260	being uploaded. So if you, for example, want to connect to the cockpit of the aircraft,
512260	518560	you will do the same thing. You take the actions to connect on a secure way. If you want to connect
518560	524240	to the back of the airplane, also you're going to do things to connect to the back using a
524960	530980	different certificate system. So if you are one manufacturer of avionics, for example, and if you
530980	538740	are using different ways to connect it to the supply chain or to the equipments on board,
538740	544560	we know, for example, also airports. Airports are also establishing their system to guarantee
544560	552900	the security of the operation. So basically, you have everybody doing what they think is correct,
552900	562820	what they need to do. So we are going to a point that we are finding ourselves with thousands of
562820	569000	different certificates floating around the ecosystem with little or sometimes completely
569000	576280	no compatibility. And that's when the issue of compatibility or interoperability comes.
576280	584480	And we believe that these certificates, they, like other things, they have to be maintained
584480	591560	along hundreds of different processes and procedures. And the big challenge is to create
593240	599660	a convergence on all these important activities that are being taken nowadays.
600220	605920	I don't want to say in an uncoordinated way, but in a very loose way. So the challenge for
605920	614240	the states right now is to have a global harmonized regulations through coordination
614240	619180	and cooperation. The coordination and cooperation to face this challenge to have a global
620360	626380	harmonized regulatory framework is really necessary because aviation is international by
626740	632120	default. Airplanes do not recognize borders. I keep saying that we have checkpoints on the ground,
632120	638120	but we don't have checkpoints in the air. So cooperation and coordination to develop a
638120	643280	harmonized set of regulations is a big challenge that states are facing right now.
643280	648100	And, you know, that's a really interesting point is that challenge of it being so global
648660	653720	and each kind of state having its own rules, regulations, you know, that framework that
653720	658180	you're talking about. Are we currently in a process where that's being discussed and worked
658180	665100	on? Or is it still in the stages of, you know, it would be a nice to have and we need to work on it?
665980	670020	From an international perspective, the International Civil Aviation Organization
670020	675980	is working on that with the help, obviously, from the states, because that's where the expertise
675980	683400	relies. And we have Nikki here with us, who is helping us a lot on that subject. But this effort
683400	690580	is already ongoing. It's not an easy effort. As you mentioned, we have a challenge because we have
690580	698700	national security requirements, we have national culture, we have national ways of trust. And
698700	706300	when we have to expand this to a global environment, it keeps us awake. But we are
706300	713660	sure that cooperation and coordination with the help from experts from the states like Nikki,
713660	717760	who is here with us, we will face and we will win that challenge.
717760	719800	We'll get there, Zalo. We'll get there eventually.
721220	722140	Yeah, let's do it.
722140	726460	Do you have anything to add to that, just from your perspective?
726460	733280	Yeah, I think Zalo raises a really good point. And sometimes it's easy to forget this. I did
733280	739440	cyber for an operator back in the day before I joined the regulator. And sometimes you can think
739440	744000	of it just in terms of that one organization. But when you're having to talk about regulations and
744000	748680	international frameworks and standards, and you have to think about what's proportionate and
748680	755300	appropriate, not just for me as the state, all of the airports of all sizes that we regulate. But
755300	760800	if you look at it from Zalo's perspective, at an international level, for all the states,
760800	765600	all the organizations, all the aviation entities, it does become a challenge.
765600	769420	But I think the work is well underway. So I'm hopeful.
770960	777640	That's great. Thank you both. And I'm just turning to Harley. We've talked a little bit
777640	781940	about building bridges between the security researcher community and regulators in order
781940	787120	to help the disclosure process, help things become more transparent and safe and effective.
787120	791220	And, you know, can you talk a little bit just about, you know, the current disclosure process
791220	796680	and environment for security researchers when it comes to this in this particular industry?
798560	809660	Sure. So, overall, the security vulnerability disclosure environment is greatly improving.
810460	814320	There's a lot more adoption of coordinated vulnerability disclosure within government
814320	821560	agencies for themselves, recognition that it is valuable in industries, in the different sectors
821560	827880	that those agencies regulate. And it is becoming more accepted as a basic cybersecurity practice,
827880	832660	both in the United States and I would say internationally. And two great examples of
832660	840840	agencies that are doing this are the FDA and the Department of Justice, CISA within DHS.
840840	848020	Within the aviation industry, our experience is that it is not yet quite normalized. It is still
848020	854120	somewhat difficult. And there is a, I think, in part because it is such a highly regulated industry,
854120	861640	and because the potential negative effects on the industry of undermining passenger confidence can
861640	868300	be so negative, so catastrophic. And unfortunately, we have a media environment that when
868300	876360	it comes to anything related to aircraft safety, tends to sensationalize it. But in part for these
876360	883040	reasons, our experience is that aviation has a ways to catch up. And it's unfortunate because
883040	886960	there is a great deal of innovation that is happening in aviation right now. And the systems
886960	893940	that are put in place in the sky and satellites, a lot of them stay in place for many years,
893940	900420	as long as a generation. And so you have rapid innovation where security issues might be missed.
900420	905680	And then you have equipment that stays in operation for a very long time. And then you
905680	911560	have legacy issues with those security problems. So we think that this is an area where security
911560	917300	research can really play a valuable role. But it is important to integrate security researchers
917300	925380	and cybersecurity community into the manufacturer design. And once they're deployed,
925380	935740	the vulnerability disclosure processes. Thanks. You brought up a point about just sensationalization
936500	942820	and how the media, you know, can catch wind, or certain entities catch wind and kind of make this
942820	948820	out to be something bigger than it actually is to kind of get the headlines and get the hype.
949060	955720	Do you think that that is a barrier when it comes to wanting to disclose? Or do you think that
955720	960600	there's kind of two tracks where people want the flash and they want the publicity, so they
960600	965460	they do kind of make it a little bit more sensationalized than it is? Or do you think
965460	972060	there's also that, I don't want to say anything because I don't want that to happen. I don't want
972060	977900	my words to be misconstrued and turned into this sensationalized like, oh, you can get into the
977900	984600	to the TV on the plane and it's going to crash down. So our impression is that it's both. You
984600	990360	know, it depends on the individual researcher, their risk tolerance and sort of what their goals are.
990380	997040	If there is a legitimate vulnerability in an aircraft, I don't think that sensationalism is
997040	1004220	really necessary in order to get headlines. And if you're just disclosing it for flash
1004220	1009220	purposes and credibility purposes, then question whether you're disclosing it for the right reasons.
1009220	1012020	That doesn't necessarily mean that it's not a security vulnerability and that there's not
1012020	1017120	attention that should be paid to it, but it is really not the way to build trust. And it is,
1017120	1023200	I think that it's also very much a barrier to engagement with the industry and the agencies
1023200	1026740	with the security research community. So I think that there's work that has to be done on both
1026740	1031000	sides. I will say that, you know, I don't want to let the agencies off the hook and just say that
1031000	1038120	sensationalism is the issue. I mentioned the FDA, DOJ and other agencies earlier. Those agencies
1038120	1042200	have made great strides in the past couple of years to engage a security research community,
1042200	1047380	including attending DEF CON and just working within those agencies, areas of jurisdiction,
1047380	1052420	like FDA for medical devices and DOJ, they're being more transparent on things like
1052420	1058380	coordinated disclosure, prosecutions and researcher protection under DMCA.
1058440	1065140	Shout outs to Leonard Bailey and Suzanne Schwartz. But FAA and the aviation industry
1065880	1070620	have a ways to go. I know that there's good work on cybersecurity being done at FAA,
1070620	1076220	like by Susan Kaebler, but they're not really being clear, in our opinion, publicly clear,
1076220	1081260	that they care a lot about cybersecurity and that they want to build relationships with the
1081260	1086040	cybersecurity community. It's just not clear. It's quite difficult right now to find much
1086040	1092220	cybersecurity specific guidance on aviation systems from FAA, both on manned aircraft and
1092220	1097580	unmanned aircraft. Unmanned aircraft being a huge area of concern since that is consumer level
1099240	1104260	devices. And there's even less information out about how security researchers can work
1104260	1112420	with these agencies. So our advice is twofold. One, for researchers to work to gain understanding
1112420	1117960	about the unique context and pressures that the aviation industry is under, to be respectful,
1118300	1123540	manage media to avoid sensationalism and work to build trust. But our advice also to the FAA
1123540	1127560	is to encourage the aviation community to build bridges with the security community
1127560	1132840	and to actually facilitate that engagement. Make clear that you are making an effort to bring in
1132840	1137880	experts from the cybersecurity community, not just the aviation industry, for input on their
1137880	1143820	guidance and their activities. Carly, thank you so much for that. You make a great point just about
1143820	1150420	building trust. And you know, at the Aerospace Village, that is our core mission is to build
1150420	1155200	the bridges of trust between the security researcher community and the aerospace industry
1155200	1159520	itself to kind of formulate those relationships so that we can have these conversations.
1159520	1165160	And so I'd like to kind of spend some time talking with you all about, you know, what we can do to
1165160	1170800	forge those relationships in order to build that trust. You know, Nikki, I know in a prior
1170800	1177500	conversation, we had talked about, you know, how in the UK industry has acted as, you know, a conduit
1177500	1184400	between GoodFaith, the hacking community and the regulators. And, you know, I wonder if you think
1184400	1190620	this approach is sustainable, or do you hope that that, you know, relationship evolves to where
1190620	1194720	that community feels like they can go straight to the regulator? Because right now, it seems like
1194720	1199960	if you have that conduit, it's working. But I wonder if you hope that it evolves so that they
1199960	1205820	go directly to you. Yeah, that's a really good point, Caitlin. And I think Carly's raised some
1205820	1212020	really good points as well. And at the moment, we have had reports come to us, largely through
1212020	1219460	researchers or cyber specialists that have been asked by our industry to perform specific testing.
1219580	1223300	And that's great, because that shows that we're building that relationship with our industry,
1223300	1230260	that they trust us and want to report to us about issues like that. But going forward, I'd absolutely
1230260	1236140	love to have the research community feel like they can get in touch with us. And I think
1236140	1242020	importantly, and Harley, you mentioned, you know, customer confidence and passenger confidence,
1242020	1248620	which I think is so important. And I think the media and sensationalism element doesn't help.
1248620	1253640	And I have to admit that as a safety regulator, you know, we do get nervous. When it's safety
1253640	1259580	critical systems, we do get nervous. So I think it's about how the reporting is done and how that
1259580	1265800	engagement works. But for me, you know, my absolute perfect scenario would be to have early engagement
1265800	1271840	with researchers. Like, you know, when you're planning on what research you want to be doing,
1271840	1278220	having a good conversation then, because sometimes there are aviation contextual elements that might
1278220	1282740	be helpful for the researcher to know about, because it might impact how they decide they
1282740	1288240	want to do that research even. You know, there's an air navigation service provider guy that I talk
1288240	1291700	to, and he always goes, well, Nikki, that's not an issue, because I can just look out the window.
1291700	1296140	So sometimes there are, you know, non-technical, but aviation contextual elements that could be
1296140	1302740	helpful in that research. So I think, you know, earlier the better. And it'd be great to be part
1302740	1308540	of that discussion about focusing on areas that need more research, because either industry aren't
1308540	1312980	able to do it themselves, or we aren't able to do that. And we need that research community to help
1312980	1318840	with that. But to have those good conversations early on between the operators and the manufacturers
1318840	1325260	and ourselves and the researchers, that can be kind of well planned. I was just thinking,
1325260	1330800	so the Oxford University published a really great research paper on pilot reactions to
1330800	1337000	hacked avionics, and had a great conversation with the researchers afterwards. And they were
1337000	1341280	talking about ideas for the next research paper. And, you know, it's something we'd love to get
1341280	1347200	involved in and help support, and see how we can, at the end of it, end up with a safer aviation
1347200	1352800	environment. So I think that would be great. Nikki, I'm so glad you brought up that talk,
1352800	1358460	as it is going to be featured, or that research is going to be featured in the Aerospace Village. So
1358460	1364400	if you are interested, there will be a discussion and a presentation on that. So thank you for the
1364400	1374220	plug. Salo, I do know that, and Pete Cooper tipped me off to this, that ICO has released a
1374220	1378480	cybersecurity strategy. And in there, there's a line about security researchers, and how
1378480	1383920	you'll work together. And just kind of curious to your thoughts about how that will work, and
1383920	1391140	kind of what's being done to bring that to life. Thanks, Kaylee. And just before addressing that
1391140	1396640	point, that is, it's very, it's such a good provocative question, actually. And I'm a
1396640	1402480	researcher myself, so I like that point, because I'm playing on both sides. But just to
1402480	1407800	just add one point that Harley mentioned before, I think sometimes we don't have much information
1407800	1414200	nowadays about aviation, and the cyber aspects related to aviation, because lots of the concepts
1414200	1421580	and decisions are still to be made. There are lots of ongoing developments right now, lots of,
1421580	1427920	let's call, like we call in IKEA, some uncertainties. And sometimes it's better not to
1428500	1435080	to spread some information that's not mature to the community, because it may create lots of
1435080	1440860	confusions. So we try to spread the information. I'm not trying to defend FAA. I'm just saying
1440860	1446800	that sometimes we do not spread the information, just to avoid the creation of a situation that
1447380	1453480	may actually not be helpful to our system. But coming back to what you said, and I mentioned
1453480	1459900	to you that it's a very provocative question, and I can't, honestly, I hope I can be short
1459900	1466180	in my answer, although I really think that this would be the specific discussion. I'm going to
1466180	1472660	talk about research and trust. It's a specific discussion that needs to start, that needs to
1472660	1480240	have. And I would start just making a small statement, or what you call an observation,
1480240	1487440	on how, and I think Nick mentioned that point, or you mentioned too, and how trust affects
1487440	1493820	that relationship between different stakeholders. Because this is really important to be aware. And
1493820	1503400	we see trust like a form of faith in the outcome of another's actions. So we have to think about
1503400	1511600	that. Trust exists in a context of kind of imperfect knowledge, like not mature or imperfect
1511600	1519180	knowledge, and also thinking about a possible future contingency. And as I said, you know,
1519180	1528580	it is a form of belief despite uncertainties. That's how we see trust. And also, since the
1528580	1534660	beginning of the century, but in all modern society, trust has been conceived as a mechanism
1534660	1540260	that will help us to reduce the bureaucracy, the complexity, and enhance, obviously,
1540260	1550680	communications between or among different stakeholders. And also, we can use the trust
1550680	1560380	to reduce the need of a very strict regulation, like a contract, for example. So in the
1560380	1568120	international aviation, there is a very sensitive ecosystem. You know, aviation,
1568300	1577580	it goes to the headlines. You know, aviation, the media does not forgive us. The small incident
1577580	1583700	goes to the first page, goes to any media headline. So we have to be
1585600	1592300	conscious that the ecosystem is really sensitive to that. And we see in aviation,
1592620	1599320	from an international perspective, the human element of it is the core, is in the core,
1599320	1605760	at the core of cybersecurity. It is critically important for the international aviation
1605760	1612880	community that, obviously, the civil aviation sector increases the number of personnel that
1612880	1620460	is qualified and knowledgeable in both, and Harley correctly mentioned, that's not only aviation,
1620460	1626040	but also aviation and cybersecurity. And this is a new area that is coming now. For example,
1626040	1630760	I have to be honest, I'm 36 years in aviation, so I know a lot about aviation. I know a lot
1630760	1635960	about aviation. But the last five years, that's when I started learning about cybersecurity,
1635960	1641140	actually. So I can't consider myself a cybersecurity expert. No, I cannot. I can't
1641140	1647800	consider myself an aviation expert, for sure, but not a cyber. And we have to have disqualified
1647800	1654540	people in aviation and cybersecurity. And this, obviously, you have a different process
1654540	1661660	to achieve that through recruitment, through education, training. But one significant way
1661660	1666940	to advance is through research. Research is very important. And that's why I decided to go back
1666940	1672240	to the research community, and I've been doing research with these states. And as such, as part
1672240	1678520	of the ICAO strategy, as part of the international strategy, we, the International Civil Aviation
1678520	1685280	Organization, we encourage all these states to set up the appropriate mechanisms for cooperation
1685280	1691720	with what we call the good faith, you know, the good faith research, which is basically the
1691720	1697540	research activity that's carried out in an environment that is appropriate, and is designed
1697540	1704360	to avoid affecting what we, for us as a part of all that is safe, the security, and like we are
1704360	1710760	seeing nowadays, the continuity of operations. So, ICAO encourages states to do that approach.
1710760	1718120	But obviously, again, we go back to the aspects of trust. They are different in different societies.
1718120	1723540	There are different ways of cooperation. So, we have to encourage and help the states to do that,
1723540	1729300	because at least from this area that we see nowadays, cybersecurity research is the one
1729300	1734920	will allow us to advance faster and achieve the results that we want to keep safety and
1734920	1740300	continuity of operations as we have been doing for the last 100 years.
1742900	1747640	Thanks, I think that's a great answer and also gives me a lot to think about too, just in terms
1747640	1753140	of how, you know, the point about everybody thinks about trust differently in different communities.
1753140	1757400	And so, you know, when we say that, oh, it's important to build trust, you know, what does that
1757400	1762100	actually mean to the different stakeholders in the different groups? Harley, I'd be interested to
1762100	1769500	get your thoughts on this, as we talk about, you know, what needs to happen and where we need to go.
1770240	1775780	From your perspective, you know, what are some things that the aviation industry can do to kind
1775780	1783080	of build that bridge and that trust? So, first of all, I think the aviation industry,
1783080	1787280	there's a number of things, but focusing just on the relationship with security researchers,
1787560	1794600	mentioned a few things before, but it would really be helpful to have guidance for researchers on
1794600	1800660	vulnerability disclosure. And this can come in the form, perhaps ideally, in the form of model
1800660	1807040	guidance from the FAA. Essentially, something that tells people what the FAA wants them to do
1807040	1812560	in a situation where they have a vulnerability to disclose. What is the mechanism for the FAA
1812560	1818760	to know about a vulnerability, since it is, you know, just the FAA that can decide whether a
1818760	1825420	vulnerability is safety critical. And unfortunately, there's a, you know, the alphabet soup
1825420	1831720	of agencies in the United States kind of makes understanding what the agency roles are a bit
1831720	1839180	difficult, right? So, FAA is safety critical features in aviation, but CISA and DHS is the
1839180	1843760	lead cybersecurity agency. So what, you know, where do researchers go if they're trying to
1843760	1848720	disclose? Is it both? You know, this is not something that researchers who, you know,
1848720	1853140	are focused on technical subjects and not necessarily on managing government bureaucracy
1853140	1857160	should have to try to figure out on their own. There should be clear public guidance about that.
1857260	1863660	And FAA, in particular, can play a great role in leading the charge on distributing that type of
1863660	1868380	guidance and encouraging industry stakeholders to do it as well. A note of caution, though,
1868380	1874680	for the industry as well as for the FAA is that there may be an impulse to say, well, aviation is
1874680	1880500	special because there is, you know, safety components. Well, true, but that also exists
1880500	1886040	for vehicles. It exists for medical devices. This has been done before. It's not going to be viewed,
1886040	1892500	you know, by researchers as being so special that they would willingly submit to a process that
1892500	1898500	is completely locked down, right? So if you are looking at having a vulnerability disclosure
1898500	1904100	process and having it completely under NDA and, you know, restricting the ability of researchers
1904100	1909060	to do anything with their research or to disclose in the event of a disagreement and so forth,
1909060	1913840	that could very well backfire. I think the research is going to happen sort of regardless.
1913840	1918320	Many of these components can be purchased on the second-hand market. Certainly when it comes for
1918320	1925280	unmanned aircrafts, those are increasingly easy to purchase. And so the research is going to happen,
1925280	1929100	you know, the key is going to be building an engagement that both sides can live with,
1929100	1932780	not one that locks down researchers and then violates the trust that you're supposed to be
1932780	1938820	trying to build in the first place. So I think you bring up a really good point about, you know,
1938820	1944820	the second-hand market and like the research is going to happen with or without the industry.
1944820	1951380	And I wonder if, you know, from my perspective, I feel like that should change and
1951380	1957340	there should be this, you know, we don't want you going to get older equipment or second-hand
1957340	1961060	equipment that's already been used. We want you to get the stuff before it's being used to
1961060	1967040	identify, you know, what challenges or problems, vulnerabilities lie within. And I wonder,
1967040	1974520	you know, from both your perspective, where do you think that barrier comes from? And then from,
1974520	1980320	Nikki or Salo's perspective, you know, why isn't industry or regulators like approving,
1980320	1986820	oh yeah, we want you to take a look at these components before they get put into use. And
1986820	1992140	I wonder if that's back to Salo's earlier point of digital transformation. It happened ahead of
1992140	1998300	security, it appears in a lot of cases across many industries, but now we're trying to play
1998300	2003960	that catch up. But it's, is it a fear that, oh, we've been using this stuff and we don't want to
2003960	2009680	know what's, you know, vulnerable. And so I just, I'd love to get all three of your perspectives on,
2009680	2014980	you know, what you think needs to happen to kind of stop that. Oh, we have to go somewhere else
2014980	2021460	besides the source to get the information to do the research. So Kaylin, just one, one thing,
2021460	2028360	I think that it's maybe important to note here. So ICAO have published a cyber security strategy,
2028840	2032720	which was published fairly recently. Salo probably knows this better than I do.
2032720	2037880	But, but one of the things that's clearly called out in there is that states should be
2038980	2044540	enabling mechanisms so that good faith researchers can collaborate. So, you know,
2044540	2049540	ICAO recognize the importance of that. Hopefully more states will be recognizing the importance
2049540	2053740	of that. I mean, Harley, I, you know, I get your point. Sometimes it is confusing and it's not
2053740	2058880	always clear who you're supposed to report what to. But I think it's, you know, hopefully that's
2058880	2065000	something that that is a quick win that many states can implement fairly easily, you know,
2065000	2070400	to start kind of building at least the mechanisms for reporting in. So just my two cents on that
2070400	2075960	one. Hopefully that's something we can move forward. So I don't want to diminish the fine
2075960	2081340	work of ICAO and others in producing those types of guidance. I mean, I guess part of the point is
2081340	2086520	that states should implement that guidance. Yeah, yeah, totally agree, totally agree.
2087860	2094460	Yeah, I know that, Harley, you have a good point. And I want to say from a global perspective,
2094460	2100900	we cannot enforce. We have to encourage the states to take actions and help them
2100900	2107900	to take the necessary actions. That's what the International Civil Aviation does. But I may
2107900	2115220	have a different perspective from you when we talk about cooperation and collaboration at a
2115220	2122480	global level. As I'm saying, I'm a researcher myself. And I see mainly in Europe, a lot of
2122480	2128500	cooperation and cooperation going on a lot of coordination. I participate every year in some
2128500	2133400	what we call innovation days in Europe, where we put all the research community together,
2133400	2140160	and we discuss several subjects. And last year, I was there to talk about exactly this subject.
2140160	2148960	And I see the community very engaged on that. I can't specify to you now to the community how
2148960	2156140	this happens all over the world, state by state, because again, there are some regional differences,
2156140	2161760	there are some national differences, there are some different ways to produce regulation and
2161760	2168180	to deal with the research community. But from a global perspective, I can tell you that
2168680	2175900	the cooperation is ongoing. Obviously, sometimes there are some, although you may not agree with
2175900	2183480	that aviation is a special industry, but I keep saying the same thing that thousands of people die
2183480	2189620	on car accidents every day. And nobody knows and nobody cares. If you have one aircraft who crashes
2189620	2197020	for a small thing that could be and kill 50 people, it will be on the first page of any
2197020	2204360	newspaper, it will be on the headlines of any television channel. So that's what we call
2206200	2211420	aviation as a special industry, because we are doing something that goes against the nature,
2211420	2216840	right? We're not made to fly, okay? We are not made to fly, and we fly, and we fly. We're doing
2216840	2221200	something against the nature. So this calls the attention of the community, because we're doing
2221200	2227320	something that is special. We are flying and we are not made to fly. So that calls attention. So
2227320	2234360	sometimes in the aviation industry, we try to be very conservative in our approach, just to avoid
2235140	2241680	people. I will use killing as an example. I don't want killing going on a holiday. I don't want you
2241680	2252540	guys going to the airport thinking, oh my gosh, am I going to arrive to my destination today or not?
2252880	2257120	We don't want you to think about that. I want you to go to the airport like you go today. You go
2257120	2262800	there and say the maximum reward is my flight is going to be 30 minutes late, 10 minutes late,
2262800	2267960	one hour late, but you never think about the safety of flight. You never think about that,
2267960	2274420	because you know that our industry has a high level of safety and is very conservative. I have
2274420	2279740	to be honest to you, and we are evolving, we are improving this, but we are very conservative
2280280	2287260	because of the attention that the industry attracts from the media when something goes wrong.
2287260	2295060	But I think I see the research community coming very, very closer to the aviation stakeholders
2295060	2302380	and producing very good material. And I always give the example of Europe, although I'm not European,
2302800	2309020	but I always give the example of Europe because I can see the cooperation going there. And I'm
2309020	2315580	quite happy with the scenario that I see there in terms of cooperation, industry and research
2315580	2321780	community. Just to clarify, so the comment about aviation not being special, that was more
2321780	2326240	from the researcher's perspective on whether they're going to perform the research or not.
2326240	2333240	I absolutely agree that the way the media handles safety issues with aviation is different from
2333240	2339080	things like cars, like vehicles. And that is something that I think is important for
2339080	2345180	researchers in particular to consider as they're conducting their research,
2345180	2350040	and I think it requires special outreach from both the researcher as well as whoever's
2350040	2356040	facilitating the disclosure, whether it's FAA or CISA, to help manage the media to avoid
2356040	2362000	unnecessary sensationalism. And on the collaboration point, I don't want to sound
2362000	2366760	all doom and gloom. Remember, I opened with saying that I do think it is changing. It is changing,
2366760	2370920	and it's changing in a lot of different industries, aviation included. The fact that we have an
2370920	2378320	aerospace village at DEFCON is proof positive of that. It's just there is a sense that it is
2378320	2383680	lagging behind in some other industries, I do think medical devices being a really good example.
2384160	2388420	But it is happening. The collaboration is increasing, and I do think that that's very positive.
2389640	2394100	And Harley, I know that within, I believe, the last year, you know, your organization has
2394100	2400720	worked with the aviation industry and the aerospace industry on a disclosure. And so I'd be
2400720	2405280	interested just to get your perspective on that process, and if it was what you expected, or if
2405280	2410900	it was better than you expected, or, you know, just kind of talk us through, you know, that process.
2411100	2416540	Because I do think, you know, it gives a good picture of where things stand now, and hopefully
2416540	2424120	where they'll go. Okay, well, so it's a happy story. It's a positive ending.
2425920	2430640	And ultimately, you know, vulnerability disclosure ought to be a positive thing. It ought to be a,
2430640	2436340	hey, we, you know, an independent genius found a security flaw, and worked with the industry,
2436340	2440640	and worked with regulators, and now it's fixed, and everybody's safer. That's the ideal
2440640	2446980	scenario. And ultimately, that's how it went for us. One of our brilliant researchers, Patrick
2446980	2453580	Kiley, who is also a pilot, discovered a flaw in CANBUS. So, of course, that's, you know, the
2453580	2459300	network standard that enables control over vehicle launches. And he demonstrated that it was possible
2459300	2465900	to send false messages through CANBUS that could, among other things, display incorrect information
2466360	2471300	to the pilots, such as compass, and altitude, and engine data. And that can have a serious
2471300	2477860	impact. So, Rapid7 worked for about a year to coordinate the vulnerability disclosure with
2477860	2482320	government agencies, as well as the industry. There wasn't, you know, like a single manufacturer
2482320	2489280	whose CANBUS is used so widely. And it involved a lot of collaboration with the FAA, with CISA,
2489300	2496580	and the aviation ISAC, and, as I mentioned, with the media. And honestly, our experience was a bit
2496580	2504980	mixed. Initially, the ISAC and the FAA were inclined to dismiss the CANBUS flaw, because
2504980	2513100	to exploit it required some level of physical access to the craft's wiring. But that could be
2513100	2519660	done, for example, by compromising an existing device on the craft. But the ISAC and the FAA had
2519660	2525200	argued that their physical security controls around aircraft prevented this from ever happening.
2525340	2530220	And from our perspective, you know, this was us learning about this and learning, you know,
2530220	2533860	learning more about the, you know, the unique other controls that are around aircraft,
2533860	2538120	but also deciding that they were right that physical controls reduce the risk,
2538120	2544300	but that physical controls alone were not a complete substitute for secure network design,
2544300	2548820	and that relying just on physical security was unwise. And, you know, unfortunately, to be real
2548820	2553440	frank, at least in the early days, it felt like the priority was avoiding that pressure of the
2553440	2562280	industry. On the other hand, we found CISA, within DHS, to be excellent facilitators of the coordinated
2562280	2567540	disclosure process. And they actually went out of their way to independently verify Rapid7's
2567540	2573080	findings and to put out their own advisory on the CANBUS flaw. And this lent additional
2573080	2577360	credibility to the seriousness of our research, which was ultimately helpful in getting buy-in
2577920	2584120	from the industry, from the ISAC, from FAA. And importantly, Rapid7, we were also, you know,
2584120	2590440	very responsible as researchers. We, you know, worked privately with these entities and worked
2590440	2596200	under embargo with the media long before going public in order to put the findings into context
2596200	2602200	and to note that the risk was reduced because of physical security controls to avoid sensationalism
2602200	2608180	and so that we could come go out publicly when there was a greater understanding of what exactly
2608180	2613140	the issue was and what mitigations were possible. And we recommend that, you know, researchers take
2613280	2619080	a similarly cautious approach. And so in the end, in the end, after about a year of verification
2619080	2625060	and coordination, the flaw was disclosed publicly in the white paper. There was not a ton of hype
2625060	2629520	in the media, although it was acknowledged in the media, and we think it was ultimately a win
2629520	2636220	for collaboration, coordinated disclosure, and the value of security research in avionics systems.
2638810	2644550	Thanks, Harley, for walking us through that and in your experience. I am glad that we were
2644550	2653110	able to end it on a happy note of success. Coming from, I'm a media communications person, so I do
2653110	2660390	know how hard it is, you know, in the cybersecurity space, especially, you know, it's hard to get the
2660390	2664810	stakeholders at an organization to get on board with, you know, talking to the media and doing
2664810	2669630	things like that. And then, you know, that only helps to build trust. I mean, there's a great core
2669630	2674030	of cybersecurity journalists out there who truly want to get the story right and they want to get
2674030	2680170	the facts out there and they're not about sensationalism. And so I do think that, you
2680730	2685830	is going to help this process in a lot more ways than once. I'm glad that you brought it up because
2685830	2691130	I do think there are trusted, you know, media advocates out there that want to get it right
2691130	2695350	because they want to see this happen more. They want to see, you know, the communities working
2695350	2701190	together, research being disclosed, and then acted on. And so I'm really happy to hear about your
2701190	2707730	process and the success that you guys had at Rapid7. We're running up a little bit on our
2707730	2711850	allotted time. So I just want to make sure that each of you have, you know, a few minutes to say
2711850	2718130	any final parting thoughts. And again, just thank you so much for taking the time. It's been just a
2718130	2723490	pleasure speaking with you.
2723490	2725450	Legs first.
2725450	2731090	Thanks, Paulo. I was going to say, Harley, that's, you know, such a great example of Rapid7's
2731090	2735690	research and your own research and such a positive outcome. And I think, you know, hopefully in
2735690	2742010	future it won't take a year. Hopefully in future people on both sides will be more aware of, you
2742010	2746770	know, the context and the environment and the requirements, the situation, so that those
2746770	2752030	disclosures can happen faster and you can have, you know, an overall positive experience, not just
2752030	2757850	like partially positive. But no, that sounds like really, really great work. And I just want to say
2757850	2762110	thank you to the Aerospace Village for having this panel today. I think it's really positive.
2762110	2767010	And I'd also like to thank the GoodFaith researchers out there. I think that their
2767010	2773090	work is really, really important. You know, we do need it. The aviation industry needs it.
2773130	2778250	And the only ask that I have is that they don't give up on building those bridges and they do
2778250	2783010	reach out and they do try to get in touch. Because I know, you know, we as a regulator really do want
2783010	2790970	to have those conversations. So thank you. Just like to thank you for the opportunity to be here
2790970	2797530	with you guys. I really appreciate that. And we encourage the research community to come closer
2797530	2806310	and closer to the regulators, to the avionics manufacturers and the aircraft manufacturers,
2806310	2812430	because they all need the work the research community does. For example, in ICAO,
2812430	2817330	you also need. The only difference is that papers presented to ICAO, most of the time,
2817330	2822050	they are not scientific papers. They are more technical papers. So you have to
2822050	2828470	adequate the language because the community is a very broad community that sometimes they will not
2828470	2837870	get if you go on the scientific language. So I really encourage anybody to come to us
2837870	2844390	and present whatever research you're doing. We are always open to receive information from
2844390	2849270	different sources. And we really appreciate that. And we need that. As I said, I'm a researcher by
2849270	2854790	myself. And I really appreciate when I have to cooperate with my peers in the academia and
2854790	2861070	translate what they are saying into international civil aviation language and put to the community
2861070	2865290	to be discussed. I really appreciate it. And thank you for the opportunity again.
2867680	2875520	And they kind of said it all. So at the risk of repeating, but thank you very much for having
2875760	2883140	us on the panel. Thanks for hosting the aerospace village at all and DEFCON. Thanks for working so
2883140	2887500	hard to build bridges between these different communities. Also thank you to the security
2887500	2892420	researchers for the work that they're doing. The aviation industry for slowly changing,
2892420	2896160	for changing and accepting this community. I know that it's painful and they're not
2896160	2903280	always the easiest community to deal with. And I guess one last thing, I suppose,
2903280	2908460	it's kind of poignant that we're doing this remotely and that everybody's under a lot of
2908460	2915080	stress and probably missing this annual gathering of such a unique and colorful community. So just
2915080	2922600	much love to that community and stay safe. Thank you all so much. And yes, I hope to Harley's point
2922600	2929160	that next year or the year after we can do this panel again and we can be in person and I can
2929160	2933940	meet all of you. But thanks again from the aerospace village. We so appreciate your time
2933940	2939200	and your insights and just have a great rest of your day. Thanks.